Description
usbh_device_init() in subsys/usb/host/usbh_device.c rejects a device whose device descriptor advertises bNumConfigurations == 0, but it only logs the error and jumps to the cleanup label without setting the return code. At that point the local err is still 0 from the preceding successful descriptor read, so the function returns success while having skipped usbh_device_set_configuration() — the only place udev->cfg_desc is allocated. The device structure is zero-initialised by usbh_device_alloc(), so udev->cfg_desc remains NULL.

usbh_device_connect() treats the zero return as a successful enumeration and calls usbh_class_probe_device(), which starts its descriptor walk from udev->cfg_desc. usbh_desc_get_next_function() passes that NULL pointer to usbh_desc_is_valid(), whose only guard compares the caller-supplied size, so head->bLength is read through a NULL pointer.

The condition is triggered entirely by the attached peripheral: attaching a USB device (or any USB gadget emulating one) that reports bNumConfigurations = 0 reaches the defect directly from the UHC_EVT_DEV_CONNECTED_FS/_HS event handler in subsys/usb/host/usbh_core.c, with no authentication and no user interaction beyond the physical attachment.

On targets where page zero is unmapped or CONFIG_NULL_POINTER_EXCEPTION_DETECTION is enabled this raises a fatal exception in the USB host thread, denying service to the host. Where address zero is readable, the descriptor walker instead parses low memory as a descriptor chain and can dispatch a class probe() with attacker-influenced values, causing further out-of-bounds reads through the still-NULL udev->cfg_desc in usbh_desc_get_iface(). No attacker-controlled write was identified, so the impact is availability plus a bounded out-of-bounds read. Note that CONFIG_USB_HOST_STACK is marked experimental.
Published: 2026-11-09
Score: 4.6 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service via null pointer dereference
Action: Immediate Patch
AI Analysis

Impact

A USB host stack function that should detect and reject devices advertising zero configurations instead returns success, leaving a configuration descriptor pointer null. Subsequent class probing then dereferences this null pointer, causing a crash or a bounded out‑of‑bounds read. The flaw therefore results in availability loss (the USB host thread dies) and potentially leaks low‑memory data. No write primitive is involved, so the impact is limited to unavailability and read exposure.

Affected Systems

Zephyr RTOS, experimental USB host stack. The vulnerability affects any build that includes the USB host subsystem and does not enforce checks against devices advertising zero configurations. No specific version range is listed, but the commit that implements the fix is available in the Zephyr RTOS repository.

Risk and Exploitability

The CVSS score is 4.6, indicating a moderate severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires physical attachment of a USB device that reports "bNumConfigurations = 0" – no authentication or privileged interaction is necessary. The attack is local to the target and leverages the host’s event handler, making it trivially actionable for anyone with access to the USB port.

Generated by OpenCVE AI on November 9, 2026 at 23:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Zephyr patch that updates usbh_device_init to correctly set the return code and avoid the null pointer dereference (commit 04e4284b4c3d3cd41791d44d7c39361e268b4d02).
  • If an upgrade is not possible, enable CONFIG_NULL_POINTER_EXCEPTION_DETECTION in the Zephyr configuration so that the fatal exception is caught and handled gracefully.
  • Disable the experimental USB host stack (CONFIG_USB_HOST_STACK=n) or restrict USB device enumeration on devices that must remain available.
  • Ensure that no USB peripherals that report zero configurations are connected to the system.

Generated by OpenCVE AI on November 9, 2026 at 23:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Nov 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Mon, 09 Nov 2026 22:15:00 +0000

Type Values Removed Values Added
Description usbh_device_init() in subsys/usb/host/usbh_device.c rejects a device whose device descriptor advertises bNumConfigurations == 0, but it only logs the error and jumps to the cleanup label without setting the return code. At that point the local err is still 0 from the preceding successful descriptor read, so the function returns success while having skipped usbh_device_set_configuration() — the only place udev->cfg_desc is allocated. The device structure is zero-initialised by usbh_device_alloc(), so udev->cfg_desc remains NULL. usbh_device_connect() treats the zero return as a successful enumeration and calls usbh_class_probe_device(), which starts its descriptor walk from udev->cfg_desc. usbh_desc_get_next_function() passes that NULL pointer to usbh_desc_is_valid(), whose only guard compares the caller-supplied size, so head->bLength is read through a NULL pointer. The condition is triggered entirely by the attached peripheral: attaching a USB device (or any USB gadget emulating one) that reports bNumConfigurations = 0 reaches the defect directly from the UHC_EVT_DEV_CONNECTED_FS/_HS event handler in subsys/usb/host/usbh_core.c, with no authentication and no user interaction beyond the physical attachment. On targets where page zero is unmapped or CONFIG_NULL_POINTER_EXCEPTION_DETECTION is enabled this raises a fatal exception in the USB host thread, denying service to the host. Where address zero is readable, the descriptor walker instead parses low memory as a descriptor chain and can dispatch a class probe() with attacker-influenced values, causing further out-of-bounds reads through the still-NULL udev->cfg_desc in usbh_desc_get_iface(). No attacker-controlled write was identified, so the impact is availability plus a bounded out-of-bounds read. Note that CONFIG_USB_HOST_STACK is marked experimental.
Title NULL pointer dereference in the Zephyr USB host stack when a device reports zero configurations
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 4.6, 'vector': 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-11-09T22:03:59.315Z

Reserved: 2026-09-12T18:04:39.470Z

Link: CVE-2026-90587

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-09T23:30:18Z

Weaknesses